Privacy & Security Tools FAQ: Common Questions Answered

A strong password is at least 12–16 characters long and uses a mix of uppercase letters, lowercase letters, numbers, and symbols. It does not contain dictionary words, personal information (birthdays, names), or predictable patterns (123456, qwerty). Use a unique password for every account. Generate a strong password for free.

A cryptographic hash function converts any input to a fixed-length output. SHA-256 always produces a 64-character hex string. Hashing is one-way — there is no mathematical way to reverse it. However, common passwords can be cracked via precomputed "rainbow tables." Always salt passwords before hashing. Generate hashes for any input here.

MD5 produces a 128-bit (32-character) hash. SHA-256 produces a 256-bit (64-character) hash. MD5 is fast but cryptographically broken — collisions have been demonstrated. SHA-256 is part of the SHA-2 family and is considered secure for most applications. For password storage, use bcrypt, scrypt, or Argon2 instead. Compare hash algorithms for free.

An email address is syntactically valid if it follows the format [email protected]. An email validator checks for proper formatting, valid domain structure, and optionally checks if the domain's mail server exists (MX record check). Validate email addresses for free.

Two-factor authentication adds a second verification step beyond a password — typically a one-time code from an authenticator app (TOTP), SMS, or hardware key. Even if your password is stolen, an attacker cannot log in without the second factor. Enable 2FA on all accounts that support it.

Use a reputable password manager (like Bitwarden, 1Password, or KeePass) to generate and store unique passwords for every site. Password managers encrypt your vault with a master password. Never store passwords in plain text, browser autofill for sensitive accounts, or shared documents.

WHOIS is a protocol for querying databases that store registered domain name information — including the registrar, registration date, expiry date, and (in many cases) the registrant's contact information. It is used to research domain ownership and check domain availability. Run a WHOIS lookup for free.